#34 Data protection: 3 key considerations regarding data-subject consent for businesses

Hello everyone, and welcome back to The Lawyers Talk, a podcast by BLawyers Vietnam. I am Huynh Kim Thanh, and I am delighted to be your host for today’s episode.

In this day and age, personal data is often compared to a raw resource for businesses. However, to exploit this resource legally and effectively, there is one crucial element that businesses cannot overlook: Customer Consent.

Therefore, our topic today is 03 key considerations regarding data subject consent that businesses must grasp to build a standard and compliant data governance process.

1. Consideration 1: Which data requires consent, and which does not?

A question I believe many of us ask ourselves is: “Does every piece of data we want to process require prior permission?” The answer is: Nearly all of them do, but there are a few exceptions.

According to Article 9 of the Law on Personal data protection 2025, the general principle is that when a business performs any action, from collection and storage to usage, whether it is basic data like names and phone numbers or sensitive data like health status, the business must obtain the data subject’s consent. However, this Law also provides 05 exceptions under Clause 1, Article 19, which I consider as “urgent situations”, including:

1. First: urgent cases. For instance, to protect the life, health, or honor of the customer themselves or others in an emergency. In such cases, the consent requirement is waived to ensure timeliness. However, the parties involved in controlling or processing the data bear the burden of proof for these circumstances.
2. Second: matters related to emergency situations, threats to national security,…
3. Third: for serving the activities of the State.
4. Fourth: A very important point for businesses: it is contractual fulfillment. When a data subject has specific agreements with relevant agencies or organizations as prescribed by law, consent is not required
5. Lastly: the other cases prescribed by other specialized laws or decrees.

However, we need to take note that “No consent required” does not mean businesses are exempt from data protection responsibilities. Under Clause 2, Article 19, businesses are still mandated to establish a strict internal monitoring mechanism for these exceptional cases

2. Consideration 2: the validity of consent

Moving to the second point, we must realize that only “obtaining consent” is not enough; we must also ensure the validity of that consent. This is governed by Clause 2, Article 9 of the Law on personal data protection 2025. Accordingly, consent is only valid if it meets two factors: first, it must be voluntary, and second, the consenter must be fully informed about the types of data processed, the purposes, the identities of the data controllers and processors, and their respective rights and obligations.

Furthermore, Clauses 3 and 4 of this Article specify:

Firstly, the method of consent: It must be expressed clearly and specifically, in a format that can be printed or copied in writing, including electronic or verifiable formats. This is also further guided by Decree No. 356/ND-CP (“Decree 356”), effective from 01 January 2026.

Secondly, the 04 core principles under Law on personal data protection are:

1. Consent must be expressed for each specific purpose;
2. It must not be together with mandatory conditions that require consent for purposes other than the agreed-upon content;
3. Consent remains valid until the data subject changes it or as otherwise prescribed by law;
4. Silence or lack of response shall not be construed as consent

So, how should businesses implement this in practice? Depending on the scale and sector, each company will have a different design. However, BLawyers Vietnam suggests the following four practical solutions:

1. First: Build a simple tool with a user-friendly interface that helps users easily understand the importance of data protection, rather than just displaying a dry notification box;
2. Second: Write consent requests that are concise, succinct, and easy to understand. Avoid overly complex legal terms that may confuse the readers;
3. Third: Categorize the purposes of data use and utilize a checkbox method, allowing customers to choose what they wish to share or agree to;
4. Fourth: Establish a storage system to log consented content. For items the customer has not yet agreed to, you can record these to send follow-up requests via email or SMS later.

We can see that designing a consent process that is both professional and legally compliant is a powerful way to affirm a business’s reputation and its respect for customer privacy.

3. Consideration 3: The right to withdraw consent

We have discussed how to obtain consent and its validity. However, there is a practical aspect that businesses must handle with care—when a customer wishes to withdraw their consent.

According to Article 10 of the Law on Personal data protection 2025, data subjects have the right to withdraw their consent or request restricted processing if they have doubts about the scope, purpose, or accuracy of the information, excluding the exceptions I mentioned in the first consideration. This is a significant power, because without a clear response process, businesses face substantial legal risks and management complexities. Therefore, we would like to share the following 3 points:

1. First, regarding the form of the request: The law stipulates that a request to withdraw consent or restrict processing must be made in writing, including electronic or verifiable formats. To avoid inconsistent request formats that lead to management difficulties, I advise businesses to establish a clear process and agreement with customers from the outset. For example: design a “Withdraw Consent” feature directly on your website or publish a corresponding standard form. This ensures convenience for the customer while helping the business manage records scientifically.
2. Second, paying attention to the timeframe for receiving and fulfilling requests: Upon receiving a request, the Personal Data Controller or the Personal Data Controller-cum-Processor is responsible for accepting it and must require any Data Processor to comply within the statutory time limit. Currently, this timeframe is specifically regulated in Decree 356. A small tip for businesses: if the Data Processor is a third-party partner, you should strictly bind them to response-time clauses within your Service Contracts to avoid risks that could lead to disputes.
3. Final point: Businesses can rest assured that a request to withdraw consent is not retroactive. This means all data processing activities performed prior to the receipt of the request remain entirely legal.

From this, it is evident that mere compliance with the written law is not enough; preparing a system capable of anticipating potential risks is equally vital. Therefore, businesses need to calculate and review their systems, as well as the content of contracts with data processors and controllers, to maximize the protection of their interests.

Due to the limited duration of today’s podcast, we will conclude here. If you have any further questions regarding the content, please leave a comment so we can discuss them in our upcoming episodes.

About us, BLawyers Vietnam provides consultancy services for both domestic and foreign businesses and individuals in areas related to personal data, including legal advice, process building, drafting terms, and working with State authorities.

For more information about BLawyers Vietnam, please visit our website displayed at the bottom of the Lawyers Talk podcast screen.

Goodbye, and see you next time.

The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. We would love to hear from you.

Date: 23 April 2026